发表更新8 分钟读完 (大约1270个字)

No subject alternative DNS name matching xxx.com found

[TOC]

故事经过 TLDR;

故事太长，可以直接看这里 解决

昨天下午，突然有同事说OA打不开了，打开页面一看出现如下错误：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
500 Servlet Exception
[show] java.security.cert.CertificateException: No subject alternative DNS name
matching xxx.com found.

java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException:
No subject alternative DNS name matching xxx.com found.
	at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:328)
	at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:291)
	at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:32)
	at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:187)
	at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:164)
	at com.caucho.server.dispatch.FilterFilterChain.doFilter(FilterFilterChain.java:87)
	at com.xxx.plugin.AuthenticationFilter.doFilter(AuthenticationFilter.java:163)
	at com.caucho.server.dispatch.FilterFilterChain.doFilter(FilterFilterChain.java:87)
	at org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:65)
	at com.caucho.server.dispatch.FilterFilterChain.doFilter(FilterFilterChain.java:87)
	at com.caucho.server.webapp.WebAppFilterChain.doFilter(WebAppFilterChain.java:187)
	at com.caucho.server.dispatch.ServletInvocation.service(ServletInvocation.java:265)
	at com.caucho.server.http.HttpRequest.handleRequest(HttpRequest.java:273)
	at com.caucho.server.port.TcpConnection.run(TcpConnection.java:682)
	at com.caucho.util.ThreadPool$Item.runTasks(ThreadPool.java:730)
	at com.caucho.util.ThreadPool$Item.run(ThreadPool.java:649)
	at java.lang.Thread.run(Thread.java:662)
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException:
No subject alternative DNS name matching xxx.com found.
	at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1699)
	at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
	at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)

内心中第一反应是证书的问题，于是赶紧上cas服务器查看日志，一切正常😵
然后上OA的服务器，将证书导入，重启服务，该是什么错还是什么错。。。

上谷歌一查，应该是匹配不到证书里的DNS名，但是确实是有的呀。

由于还有其他java系统接入了CAS登录，都是正常的，于是开始怀疑是OA那台的有问题，开始查看是不是有人最近改动过什么

然鹅并没有。。。

然后查看OA的日志（用的Resin中间件。。。
发现如下错误：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
[17:00:15.288] {http--8080-6$1533061820} java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching auth.corp.flamingo-inc.com found.
[17:00:15.288] {http--8080-6$1533061820} 	at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:295)
[17:00:15.288] {http--8080-6$1533061820} 	at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:33)
[17:00:15.288] {http--8080-6$1533061820} 	at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:178)
[17:00:15.288] {http--8080-6$1533061820} 	at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:132)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.server.dispatch.FilterFilterChain.doFilter(FilterFilterChain.java:87)
[17:00:15.288] {http--8080-6$1533061820} 	at com.xxx.plugin.AuthenticationFilter.doFilter(AuthenticationFilter.java:163)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.server.dispatch.FilterFilterChain.doFilter(FilterFilterChain.java:87)
[17:00:15.288] {http--8080-6$1533061820} 	at org.jasig.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:110)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.server.dispatch.FilterFilterChain.doFilter(FilterFilterChain.java:87)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.server.webapp.WebAppFilterChain.doFilter(WebAppFilterChain.java:187)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.server.dispatch.ServletInvocation.service(ServletInvocation.java:265)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.server.http.HttpRequest.handleRequest(HttpRequest.java:273)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.server.port.TcpConnection.run(TcpConnection.java:682)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.util.ThreadPool$Item.runTasks(ThreadPool.java:730)
[17:00:15.288] {http--8080-6$1533061820} 	at com.caucho.util.ThreadPool$Item.run(ThreadPool.java:649)
[17:00:15.288] {http--8080-6$1533061820} 	at java.lang.Thread.run(Thread.java:662)
[17:00:15.288] {http--8080-6$1533061820} Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching auth.corp.flamingo-inc.com found.
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1699)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1149)
[17:00:15.288] {http--8080-6$1533061820} 	at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
[17:00:15.288] {http--8080-6$1533061820} 	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
[17:00:15.288] {http--8080-6$1533061820} 	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1172)
[17:00:15.288] {http--8080-6$1533061820} 	at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
[17:00:15.288] {http--8080-6$1533061820} 	at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:281)
[17:00:15.288] {http--8080-6$1533061820} 	... 15 more
[17:00:15.288] {http--8080-6$1533061820} Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching auth.corp.flamingo-inc.com found.
[17:00:15.288] {http--8080-6$1533061820} 	at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:193)
[17:00:15.288] {http--8080-6$1533061820} 	at sun.security.util.HostnameChecker.match(HostnameChecker.java:77)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:264)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:250)
[17:00:15.288] {http--8080-6$1533061820} 	at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185)

开始怀疑是我写的AuthenticationFilter的锅，于是用了个新版本的cas-client-core，依然不行

开始升级jdk，由于是windows，直接安装的exe，然后改了启动脚本里面的JAVA_HOME，重启依然发现不行。。。 (((φ(◎ロ◎;)φ)))

于是暂时回退到了没有用CAS接入的版本，下班了。。。

今天回来不甘心啊，继续尝试解决

既然证书找不到xxx.com，那我换台nginx直接写host试试？

更新了一下测服nginx的证书，OA主机指定测服nginx ip

然后！！！！ 可以了！！！！ 😭

然后跟同事调试了一会，发现他昨天下午添加了一个域名abc.com，然后导致了default_server不是adc.com了。。。

解决方法

更新一下jdk就可以了（摊手），OA用的是jdk1.6，jdk1.6旧版本不支持SNI，至于什么是SNI等，看这里 https://github.com/ditunes/blog/issues/13

之前没成功是因为windows的服务里面写死了jdk的路径。。。

发表更新9 分钟读完 (大约1421个字)

cas根据请求参数跳过验证

接上一篇 https://birdzhang.xyz/2018/05/15/Java%E6%94%B9%E5%86%99HttpServletRequest%E8%AF%B7%E6%B1%82%E5%8F%82%E6%95%B0/ ，这里说一下cas的坑（这里的cas是3.5版本）

虽然cas有CAS Authentication Filter，但是这个只是根据请求的uri过滤的，那么这里就出现了一个奇怪的bug

即使我在excludePaths里面添加了/test1/，但是当请求地址为/test1/123?ticket=123的时候，还是会去cas服务器验证！！！

我们来看代码：

CAS Authentication Filter 代码
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
package com.birdzhang.demo.check;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.jasig.cas.client.authentication.DefaultGatewayResolverImpl;
import org.jasig.cas.client.authentication.GatewayResolver;
import org.jasig.cas.client.util.AbstractCasFilter;
import org.jasig.cas.client.util.CommonUtils;
import org.jasig.cas.client.validation.Assertion;

public class AuthenticationFilter extends AbstractCasFilter{
	
	
	 /**
    * The URL to the CAS Server login.
    */
   private String casServerLoginUrl;

   /**
    * Whether to send the renew request or not.
    */
   private boolean renew = false;

   /**
    * Whether to send the gateway request or not.
    */
   private boolean gateway = false;
   /**
    * 添加属性，这里用来存放不过滤地址正则表达式，可以根据自己需求定制---1
    */
   private String excludePaths;
   
   private GatewayResolver gatewayStorage = new DefaultGatewayResolverImpl();

   protected void initInternal(final FilterConfig filterConfig) throws ServletException {
       if (!isIgnoreInitConfiguration()) {
           super.initInternal(filterConfig);
           setCasServerLoginUrl(getPropertyFromInitParams(filterConfig, "casServerLoginUrl", null));
           //log.trace("Loaded CasServerLoginUrl parameter: " + this.casServerLoginUrl);
           setRenew(parseBoolean(getPropertyFromInitParams(filterConfig, "renew", "false")));
           //log.trace("Loaded renew parameter: " + this.renew);
           setGateway(parseBoolean(getPropertyFromInitParams(filterConfig, "gateway", "false")));
           //log.trace("Loaded gateway parameter: " + this.gateway);

           final String gatewayStorageClass = getPropertyFromInitParams(filterConfig, "gatewayStorageClass", null);

           if (gatewayStorageClass != null) {
               try {
                   this.gatewayStorage = (GatewayResolver) Class.forName(gatewayStorageClass).newInstance();
               } catch (final Exception e) {
                   //log.error(e,e);
                   throw new ServletException(e);
               }
           }
           //自定义添加代码，用来读取web配置文件中excludes属性值 ---2
           excludePaths = getPropertyFromInitParams(filterConfig, "excludePaths", null);//filterConfig.getInitParameter("excludePaths");
           excludePaths = excludePaths.trim();
       }
   }

   public void init() {
       super.init();
       CommonUtils.assertNotNull(this.casServerLoginUrl, "casServerLoginUrl cannot be null.");
   }
//url判断逻辑，这里大家可以根据自己需要来制订规则
   private boolean isExclude(String uri){
   	boolean isInWhiteList = false;
   	if(excludePaths!=null&& uri!=null){
   		isInWhiteList = uri.matches(excludePaths);
   	}
       return isInWhiteList;
   }
  
   
   public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {
       final HttpServletRequest request = (HttpServletRequest) servletRequest;
       final HttpServletResponse response = (HttpServletResponse) servletResponse;
       final HttpSession session = request.getSession(false);
       final Assertion assertion = session != null ? (Assertion) session.getAttribute(CONST_CAS_ASSERTION) : null;
      // 该判断是自定义的对符合条件的url进行通过处理 ---3
       if(isExclude(request.getRequestURI())){
       	filterChain.doFilter(request, response);
           return;
       }
       
       if (assertion != null) {
           filterChain.doFilter(request, response);
           return;
       }

       final String serviceUrl = constructServiceUrl(request, response);
       final String ticket = CommonUtils.safeGetParameter(request,getArtifactParameterName());
       final boolean wasGatewayed = this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);

       if (CommonUtils.isNotBlank(ticket) || wasGatewayed) {
           filterChain.doFilter(request, response);
           return;
       }

       final String modifiedServiceUrl;

       //log.debug("no ticket and no assertion found");
       if (this.gateway) {
           //log.debug("setting gateway attribute in session");
           modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);
       } else {
           modifiedServiceUrl = serviceUrl;
       }

/*       if (log.isDebugEnabled()) {
           log.debug("Constructed service url: " + modifiedServiceUrl);
       }*/

       final String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl, getServiceParameterName(), modifiedServiceUrl, this.renew, this.gateway);

  /*     if (log.isDebugEnabled()) {
           log.debug("redirecting to \"" + urlToRedirectTo + "\"");
       }*/

       response.sendRedirect(urlToRedirectTo);
   }

   public final void setRenew(final boolean renew) {
       this.renew = renew;
   }

   public final void setGateway(final boolean gateway) {
       this.gateway = gateway;
   }

   public final void setCasServerLoginUrl(final String casServerLoginUrl) {
       this.casServerLoginUrl = casServerLoginUrl;
   }
   
   public final void setGatewayStorage(final GatewayResolver gatewayStorage) {
   	this.gatewayStorage = gatewayStorage;
   }
}

可以看到在uri匹配到excludepath之后会走filterChain.doFilter(request, response);，由于我们并没有对filterChain做什么修改，所以最终还是跑到cas那里去了

修改后的代码如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
package com.birdzhang.plugin;

/**
 * @author debo.zhang
 *
 */
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.jasig.cas.client.authentication.DefaultGatewayResolverImpl;
import org.jasig.cas.client.authentication.GatewayResolver;
import org.jasig.cas.client.util.AbstractCasFilter;
import org.jasig.cas.client.util.CommonUtils;
import org.jasig.cas.client.validation.Assertion;

public class AuthenticationFilter extends AbstractCasFilter{
	
	
	 /**
    * The URL to the CAS Server login.
    */
   private String casServerLoginUrl;

   /**
    * Whether to send the renew request or not.
    */
   private boolean renew = false;

   /**
    * Whether to send the gateway request or not.
    */
   private boolean gateway = false;
   /**
    * 添加属性，这里用来存放不过滤地址正则表达式，可以根据自己需求定制---1
    */
   private String excludePaths;
   
   private GatewayResolver gatewayStorage = new DefaultGatewayResolverImpl();

   protected void initInternal(final FilterConfig filterConfig) throws ServletException {
       if (!isIgnoreInitConfiguration()) {
           super.initInternal(filterConfig);
           setCasServerLoginUrl(getPropertyFromInitParams(filterConfig, "casServerLoginUrl", null));
           //log.trace("Loaded CasServerLoginUrl parameter: " + this.casServerLoginUrl);
           setRenew(parseBoolean(getPropertyFromInitParams(filterConfig, "renew", "false")));
           //log.trace("Loaded renew parameter: " + this.renew);
           setGateway(parseBoolean(getPropertyFromInitParams(filterConfig, "gateway", "false")));
           //log.trace("Loaded gateway parameter: " + this.gateway);

           final String gatewayStorageClass = getPropertyFromInitParams(filterConfig, "gatewayStorageClass", null);

           if (gatewayStorageClass != null) {
               try {
                   this.gatewayStorage = (GatewayResolver) Class.forName(gatewayStorageClass).newInstance();
               } catch (final Exception e) {
                   //log.error(e,e);
                   throw new ServletException(e);
               }
           }
           //自定义添加代码，用来读取web配置文件中excludes属性值 ---2
           excludePaths = getPropertyFromInitParams(filterConfig, "excludePaths", null);//filterConfig.getInitParameter("excludePaths");
           excludePaths = excludePaths.trim();
       }
   }

   public void init() {
       super.init();
       CommonUtils.assertNotNull(this.casServerLoginUrl, "casServerLoginUrl cannot be null.");
   }

   //url判断逻辑，这里大家可以根据自己需要来制订规则
   private boolean isExclude(String uri){
   	boolean isInWhiteList = false;
   	if(excludePaths!=null&& uri!=null){
   		isInWhiteList = uri.matches(excludePaths);
   	}
       return isInWhiteList;
   }
  
   
   
   public final void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException {
       HttpServletRequest request = (HttpServletRequest) servletRequest;
       final HttpServletResponse response = (HttpServletResponse) servletResponse;
       final HttpSession session = request.getSession(false);
       
       final Assertion assertion = session != null ? (Assertion) session.getAttribute(CONST_CAS_ASSERTION) : null;

       //hack for 云桥
       Map<String, String[]>	paramsMap = request.getParameterMap();
       
       if(null != paramsMap ) {
    	   if(paramsMap.containsKey("ticket") && paramsMap.containsKey("operation")) {
/*    		   String token = Arrays.toString(paramsMap.get("ticket"));
    		   request.removeAttribute("ticket");
    		   request.setAttribute("token", token.substring(1, token.length()-1));
    		   filterChain.doFilter(request, response);
               return;*/
               
    		   /*StringBuffer paramsBuff = new StringBuffer();
    	       for(String param: paramsMap.keySet()) {
    	    	   String newString = Arrays.toString(paramsMap.get(param));
    	    	   if(param.equals("ticket")) {
    	    		   paramsBuff.append("&").append("eticket").append("=").append(newString.substring(1, newString.length()-1));
    	    	   }else {
    	    		   paramsBuff.append("&").append(param).append("=").append(newString.substring(1, newString.length()-1));
    	    	   }
    	       }
    	       String port = request.getServerPort() == 80?"":":"+request.getServerPort();
    	       String scheme = request.getScheme();
    	       String host = request.getServerName();
    	       String redirectUrl = String.format("%s://%s%s%s?%s", 
    	    		   scheme,
    	    		   host,
    	    		   port,
    	    		   request.getRequestURI(),
    	    		   paramsBuff.toString().substring(1)
    	    		   );
    	       System.out.println("request url:"+redirectUrl);
    	       response.sendRedirect(redirectUrl);
    	       return;*/
    		   
    		   Map<String, String[]> extraParams = new HashMap<String, String[]>();
    		   HttpServletRequest wrappedRequest = new PrettyFacesWrappedRequest(request, extraParams);
    		   request.getRequestDispatcher(request.getRequestURI()).forward(wrappedRequest, response);
    		   return;
    	   }
       }
       
       
       // 该判断是自定义的对符合条件的url进行通过处理 
       if(isExclude(request.getRequestURI())){
       	filterChain.doFilter(request, response);
           return;
       }
       
      
       
       if (assertion != null) {
           filterChain.doFilter(request, response);
           return;
       }

       final String serviceUrl = constructServiceUrl(request, response);
       final String ticket = CommonUtils.safeGetParameter(request,getArtifactParameterName());
       final boolean wasGatewayed = this.gatewayStorage.hasGatewayedAlready(request, serviceUrl);

       if (CommonUtils.isNotBlank(ticket) || wasGatewayed) {
           filterChain.doFilter(request, response);
           return;
       }

       final String modifiedServiceUrl;

       //log.debug("no ticket and no assertion found");
       if (this.gateway) {
           //log.debug("setting gateway attribute in session");
           modifiedServiceUrl = this.gatewayStorage.storeGatewayInformation(request, serviceUrl);
       } else {
           modifiedServiceUrl = serviceUrl;
       }

/*       if (log.isDebugEnabled()) {
           log.debug("Constructed service url: " + modifiedServiceUrl);
       }*/

       final String urlToRedirectTo = CommonUtils.constructRedirectUrl(this.casServerLoginUrl, getServiceParameterName(), modifiedServiceUrl, this.renew, this.gateway);

  /*     if (log.isDebugEnabled()) {
           log.debug("redirecting to \"" + urlToRedirectTo + "\"");
       }*/

       response.sendRedirect(urlToRedirectTo);
   }

   public final void setRenew(final boolean renew) {
       this.renew = renew;
   }

   public final void setGateway(final boolean gateway) {
       this.gateway = gateway;
   }

   public final void setCasServerLoginUrl(final String casServerLoginUrl) {
       this.casServerLoginUrl = casServerLoginUrl;
   }
   
   public final void setGatewayStorage(final GatewayResolver gatewayStorage) {
   	this.gatewayStorage = gatewayStorage;
   }
}

关注我

分类

最新文章

广告

归档

标签

9t1
Java4
Python1
Terminating1
Tomcat1
android1
apt1
cas2
coinhive1
crt1
davinci1
debian1
docker6
drbd1
frp2
gitlab1
hadk3
https2
httpservletrequest1
hybris-15.11
hybris-16.01
ios1
ip1
iphone1
irc1
java1
jolla1
js1
json1
k201
k8s3
kubernetes4
lineage-15.11
lineage-16.01
linux1
lua1
migrate1
nginx2
okcaros1
openresty3
opensips1
pastebin1
python3
python21
rdp1
redmi3
redmi5plus2
remix1
rk35882
sailfish3
sailfishos3
signal1
sip1
socks51
subprocess1
tomcat2
trustcacerts1
ubuntu1
unix1
vince2
vmvare1
voip1
windows1
x861
xiaomi1
yavijava1
参数2
改写1
跳过1
迁移1
随笔1

订阅更新

×